fb_sig parameters

I've been working away at building my own java library for Facebook applications (Java-Spring-Book) and came across something today that was a little different.

For Facebook API calls, you need to have a session_key as one of your parameters. You get this key by asking for it with authToken. Nothing special here. So, my original plan was to store this session_key so that I didn't have to keep requesting one (and I'm sure many other people would do the same). For simplicity, I decided to store the key in the user's session.

As I started working away, I noticed that I wasn't able to store the key in the session (it was always blank on subsequent calls). Without going into the session more, I decided to try simple http cookies. They may not be the greatest, but they should do the job. Again, they weren't working. Cookies didn't seem to persist across subsequent calls. Strange, no?

From the looks of it, my code was working totally fine. There really wasn't any information in subsequent sessions or cookies. And from what I can tell, that's all by design. Here's my theory as to why:

• In your application setup, you can tell Facebook whether you want to use FBML or an iFrame to display your content (FBML is a bunch of custom tags that make building apps easier)
• In order to properly render your page inside of Facebook, a request from the user goes to Facebook to show an app. Facebook then sends a seperate, distinct request to my server to get my content. However, this request is different then the user's request, and appears to be blank each time (no persisted info). The result? No cookies for you!

So how can I go about "storing" a session_key? I don't think I have to. From the looks of it, when Facebook makes a request for my page it appends a bunch of "fb_sig_" parameters (including one for session_key). It looks like I can use these parameters in my calls.

I took a quick look through the Facebook docs and couldn't find anything. Anybody know where this might be at?